T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download.mjs:100- Finding
TLS Certificate Verification Disabled for All Downloads
- Content
View full analysis
- Remediation
View remediation
Security audit
Twitter Video Download
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it weakens download security by disabling TLS certificate checks and may expose proxy credentials in logs.
Review before installing. The skill is not showing deception or destructive behavior, but users should avoid proxy URLs with embedded credentials, expect downloads to be written to the chosen path, and prefer a version that removes the default TLS certificate bypass and pins yt-dlp.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` Then install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/download.mjs:110- Finding
Proxy Credentials Exposed Through Console Logging
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script always adds yt-dlp's --no-check-certificate option, which disables TLS certificate validation for all downloads. That makes HTTPS connections susceptible to man-in-the-middle interception or content tampering, especially on hostile networks or when a proxy is used, and the comment is misleading because the behavior is unconditional.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
Using the tool parameter --no-check-certificate weakens the security guarantees of the downstream tool by disabling server certificate verification. In this skill's context, the only job is downloading media from a specific site, so weakening transport validation is unnecessary and increases the risk of accepting tampered content or connecting through an attacker-controlled TLS endpoint.
- Content
js '--output', outputTemplate, '--no-warnings', '--socket-timeout', '30', '--no-check-certificate' // Only if needed for proxy ]; // Add proxy if set (environment variable)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares an environment-variable dependency (
PROXY_URL) in metadata but does not declare an explicit tool scope such aspermissionsorallowed-tools. That creates an implicit capability boundary where the agent may access environment-derived network configuration without a clearly documented permission model, reducing reviewability and increasing the chance of unintended secret or network-use exposure.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a narrowly scoped skill that downloads a video from a provided Twitter/X URL to a specified location. Reading process environment for PROXY_URL introduces an extra capability to consume external runtime configuration, which is not mentioned in the manifest and is not necessary to understand from the stated user-facing purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file states that the skill downloads content to local storage and supports custom save paths and filenames, which affects user data on disk. Under the markdown-specific warning criterion, the description should disclose file-write behavior and any overwrite/location implications, but no such warning is present in the usage or description sections.
- Content